Gunra ransomware targets critical infrastructure with known exploits
US cyber agencies warn critical infrastructure operators to patch vulnerabilities exploited by Gunra ransomware.
1The rise of Gunra ransomware
First emerging in 2025, Gunra ransomware quickly evolved into a global threat. US agencies including CISA, FBI, NSA, and Secret Service revealed Gunra now operates as ransomware-as-a-service (RaaS). Affiliates worldwide use the malware to target healthcare, financial services, government entities, and other critical infrastructure operators. The rapid expansion demonstrates the growing sophistication of cybercriminal operations.
2Exploited vulnerabilities
Attackers leverage authentication bypass flaws CVE-2024-55591 and CVE-2025-24472 in Fortinet's FortiOS and FortiProxy products. These vulnerabilities allow administrative access through internet-facing devices. Security experts emphasize critical infrastructure operators must immediately patch these vulnerabilities. While Fortinet released security updates, many systems remain unprotected against these known exploits.
3Double extortion tactics
Gunra operators employ standard double extortion methods after breaching systems: stealing data, encrypting files, then demanding ransom for decryption and non-disclosure of stolen information. Victims communicate through a Tor-based portal and typically receive 5-7 days before data publication. This approach has become the hallmark of modern ransomware attacks, combining financial pressure with reputational risk.
4New Linux variant emerges
Initially detected by Trend Micro in April 2025 targeting Windows systems with elements borrowed from Conti ransomware, researchers later discovered a Linux variant. The Linux version can execute up to 100 parallel encryption threads and supports partial file encryption, allowing attackers to selectively encrypt portions of files. This expands the malware's potential impact across different operating environments.
5Global impact
Gunra activity has been observed in Turkey, Taiwan, the US, and South Korea. The gang's leak site lists victims across Brazil, Japan, and Canada, including manufacturers, healthcare providers, IT companies, and law firms. The diverse targeting suggests opportunistic rather than selective attacks, with any vulnerable organization potentially at risk regardless of sector or location.
6Recommended defenses
Security professionals urge immediate patching of known vulnerabilities in internet-facing systems. They emphasize securing VPN gateways and RDP access with multi-factor authentication as critical protection measures. Network segmentation and maintaining offline, immutable backups significantly complicate attackers' efforts even after initial access, reducing potential damage from ransomware incidents.
7Sector-specific consequences
Ransomware attacks pose life-threatening risks to healthcare organizations while causing operational disruptions in financial services and government agencies. Beyond financial losses, these incidents damage reputations and erode public trust. For critical infrastructure operators, cybersecurity has become fundamental to business continuity rather than just an IT concern.
8Future risks
CISA's Acting Executive Assistant Director for Cybersecurity Chris Butera identified Gunra as part of the ongoing ransomware trend harming US and international organizations. Security experts warn the proliferation of RaaS models will likely increase such attacks. Organizations must implement proactive security measures and develop comprehensive incident response plans to mitigate evolving cyber threats.